IFS Minifilter Questions (Newbie)

NTFSD
1

Hello all,

I am currently a computer science senior, and my senior design project
involves the design of a minifilter that duplicates write requests to
multiple volumes.
My question is: What is the simplest way to duplicate the IRPs for each
instance of the minifilter, or is there another way to perform this task?

IE:

My minifilter, when installed, would be attached to 2 or more volumes, such
as

Instance A -----------------------> Volume A

Instance B -----------------------> Volume B

And it should work in such a way that whenever data is written to either
Volume A or B, it is automatically written to the other volume.

Any help would be appreciated.

Pedro Rico

2

IoAllocateIrp, IoAllocateMdl, IoBuildPartialMdl will correctly clone a write
IRP and allow you to have both writes concurrently in progress.

However I hope you have thought out the complexity of your design. Volume
mirroring, which is what I think you are describing is uncharted territory
in the ddk - there is essentially no documentation. A FS minifilter filters
above the filesystem level - but your design outline indicates a volume
level filter, which would be below the filesystem. Perhaps you are actually
going to do file replication on a per file basis - in which case you could
use a FS minifilter.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pedro Rico
Sent: Monday, November 21, 2005 8:48 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IFS Minifilter Questions (Newbie)

Hello all,

I am currently a computer science senior, and my senior design project
involves the design of a minifilter that duplicates write requests to
multiple volumes.
My question is: What is the simplest way to duplicate the IRPs for each
instance of the minifilter, or is there another way to perform this task?

IE:

My minifilter, when installed, would be attached to 2 or more volumes, such
as

Instance A -----------------------> Volume A

Instance B -----------------------> Volume B

And it should work in such a way that whenever data is written to either
Volume A or B, it is automatically written to the other volume.

Any help would be appreciated.

Pedro Rico

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

I am planning to perform the file replication on a per file basis using an
IFS minifilter, I’m sorry if I did not make that clear on my previous email.

The main problem that I have been running into is that I really have very
little knowledge of which data structures I need to replicate (or allocate)
on my minifilter code. Currently the method I have been attempting, with
very little success, is to create another FLT_CALLBACK_DATA structure, and
duplicating the FLT_IO_PARAMETER_BLOCK from the original callback structure,
and then performing a call to FltPerformSynchronousIo using the newly
allocated callback data structure. However, I am not sure if this is the
proper way to perform file replication using a minifilter.

Pedro Rico

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Tuesday, November 22, 2005 6:19 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] IFS Minifilter Questions (Newbie)

IoAllocateIrp, IoAllocateMdl, IoBuildPartialMdl will correctly clone a write
IRP and allow you to have both writes concurrently in progress.

However I hope you have thought out the complexity of your design. Volume
mirroring, which is what I think you are describing is uncharted territory
in the ddk - there is essentially no documentation. A FS minifilter filters
above the filesystem level - but your design outline indicates a volume
level filter, which would be below the filesystem. Perhaps you are actually
going to do file replication on a per file basis - in which case you could
use a FS minifilter.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pedro Rico
Sent: Monday, November 21, 2005 8:48 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IFS Minifilter Questions (Newbie)
Hello all,

I am currently a computer science senior, and my senior design project
involves the design of a minifilter that duplicates write requests to
multiple volumes.
My question is: What is the simplest way to duplicate the IRPs for each
instance of the minifilter, or is there another way to perform this task?

IE:

My minifilter, when installed, would be attached to 2 or more volumes, such
as

Instance A -----------------------> Volume A

Instance B -----------------------> Volume B

And it should work in such a way that whenever data is written to either
Volume A or B, it is automatically written to the other volume.

Any help would be appreciated.

Pedro Rico

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hello Pedro,

I’m not sure about your approach, but here are some things to consider:

  1. You are in the paging path. I don’t think you want to duplicate the paging file writes so you should ignore any I/O in which FsRtlIsPagingFile(FltObjects->FileObject) is true.

  2. To support memory mapped files (i.e. Notepad), you’ll need to duplicate paging writes. Doing work in kernel mode in the paging path can be a problem. Fortunately, I don’t think you need to do very much. You are not trying to change the behavior of the existing IRP, only cause additional behaviors. I think you can use a user mode process to do the ‘duplicate’ writes. Just send messages to user mode tasks. I’d suggest looking at chapter 10 of the ‘Filter Driver Development Guide’ on how communication is done. Also, I know the scanner example of the IFS kit uses this method to do some work in the IRP_MJ_WRITE paging path. This example may be a good starting point.

  3. I hope you know this already. You will need an instance of the filter for each Volume. You will need to distinguish ‘user’ I/O from your own duplication I/O (to avoid an infinite re-duplication). If the method in 2 is used, the thread id can be used to avoid this problem.

  4. If you want to do everything in kernel mode, consider using something like the FltXxxxxDeferredIoWorkItem calls and maybe ZwWriteFile. I don’t think FltWriteFile will work for you since you need one instance/volume to generate writes on another instance/volume. I think 3) will get messy in this case. Others can probably help you more if this is the path you want to take. I’m just guessing here.

  5. I’d suggest keeping things as simple as possible at first. For example, try to work the case where one file exists on each volume and you want to keep the file in sync for one write.

  6. Consider using filemon and/or the minispy example to see what is going on.

Good Luck,
Derek

Pedro Rico wrote:

v:* {behavior:url(#default#VML);} o:* {behavior:url(#default#VML);} w:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} Clean Clean DocumentEmail false false false MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:“Table Normal”; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:“”; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:“Times New Roman”; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} I am planning to perform the file replication on a per file basis using an IFS minifilter, I’m sorry if I did not make that clear on my previous email.

The main problem that I have been running into is that I really have very little knowledge of which data structures I need to replicate (or allocate) on my minifilter code. Currently the method I have been attempting, with very little success, is to create another FLT_CALLBACK_DATA structure, and duplicating the FLT_IO_PARAMETER_BLOCK from the original callback structure, and then performing a call to FltPerformSynchronousIo using the newly allocated callback data structure. However, I am not sure if this is the proper way to perform file replication using a minifilter.

Pedro Rico

---------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Tuesday, November 22, 2005 6:19 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] IFS Minifilter Questions (Newbie)

IoAllocateIrp, IoAllocateMdl, IoBuildPartialMdl will correctly clone a write IRP and allow you to have both writes concurrently in progress.

However I hope you have thought out the complexity of your design. Volume mirroring, which is what I think you are describing is uncharted territory in the ddk - there is essentially no documentation. A FS minifilter filters above the filesystem level - but your design outline indicates a volume level filter, which would be below the filesystem. Perhaps you are actually going to do file replication on a per file basis - in which case you could use a FS minifilter.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pedro Rico
Sent: Monday, November 21, 2005 8:48 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] IFS Minifilter Questions (Newbie)
Hello all,

I am currently a computer science senior, and my senior design project involves the design of a minifilter that duplicates write requests to multiple volumes.
My question is: What is the simplest way to duplicate the IRPs for each instance of the minifilter, or is there another way to perform this task?

IE:

My minifilter, when installed, would be attached to 2 or more volumes, such as

Instance A ---------------------à Volume A

Instance B ---------------------à Volume B

And it should work in such a way that whenever data is written to either Volume A or B, it is automatically written to the other volume.

Any help would be appreciated.

Pedro Rico

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------
Yahoo! FareChase - Search multiple travel sites in one click.